Title: [280897] releases/WebKitGTK/webkit-2.32/Source/WebCore
- Revision
- 280897
- Author
- [email protected]
- Date
- 2021-08-11 03:20:25 -0700 (Wed, 11 Aug 2021)
Log Message
Merge r274630 - Invalidate RenderTreePosition's next sibling with display:contents
https://bugs.webkit.org/show_bug.cgi?id=218578
Reviewed by Antti Koivisto.
When inserting elements in the tree from JS it might happen that the renderTreePosition() in the RenderTreeUpdater
caches a nextSibling() value which is only temporarily correct because we sequentially process the descendants of a
given root node in RenderTreeUpdater::updateRenderTree(). One of those potentially incorrect scenarios is when
using display:contents. We can detect those cases because we would leave a parent element in RenderTreeUpdater::popParent()
without changing renderingParent() and so without changing renderTreePosition(). Once we are in that situation we
must invalidate the cached position so the next sibling is recomputed.
* rendering/updating/RenderTreeUpdater.cpp:
(WebCore::RenderTreeUpdater::popParent): Invalidate the render tree position's next sibling if the parent element is not
the renderingParent().
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog (280896 => 280897)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-08-11 10:19:36 UTC (rev 280896)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-08-11 10:20:25 UTC (rev 280897)
@@ -1,3 +1,21 @@
+2021-02-26 Sergio Villar Senin <[email protected]>
+
+ Invalidate RenderTreePosition's next sibling with display:contents
+ https://bugs.webkit.org/show_bug.cgi?id=218578
+
+ Reviewed by Antti Koivisto.
+
+ When inserting elements in the tree from JS it might happen that the renderTreePosition() in the RenderTreeUpdater
+ caches a nextSibling() value which is only temporarily correct because we sequentially process the descendants of a
+ given root node in RenderTreeUpdater::updateRenderTree(). One of those potentially incorrect scenarios is when
+ using display:contents. We can detect those cases because we would leave a parent element in RenderTreeUpdater::popParent()
+ without changing renderingParent() and so without changing renderTreePosition(). Once we are in that situation we
+ must invalidate the cached position so the next sibling is recomputed.
+
+ * rendering/updating/RenderTreeUpdater.cpp:
+ (WebCore::RenderTreeUpdater::popParent): Invalidate the render tree position's next sibling if the parent element is not
+ the renderingParent().
+
2021-03-18 Frédéric Wang <[email protected]>
ASSERTION FAILED: node.isConnected() in matchSlottedPseudoElementRules
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp (280896 => 280897)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp 2021-08-11 10:19:36 UTC (rev 280896)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp 2021-08-11 10:20:25 UTC (rev 280897)
@@ -237,6 +237,9 @@
if (parent.element)
updateAfterDescendants(*parent.element, parent.updates);
+ if (&parent != &renderingParent())
+ renderTreePosition().invalidateNextSibling();
+
m_parentStack.removeLast();
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
